PT-2026-40975 · Flowiseai+2 · Flowise

Published 2026-05-14 · Updated 2026-06-11 · CVE-2026-42861

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.2

Description A mass assignment issue exists in the variable update endpoint '/api/v1/variables/{variableId}'. This allows authenticated users to modify server-controlled properties by including them in the JSON request body, as the backend lacks strict input validation and authorization checks. Specifically, an attacker can manipulate the workspaceId, createdDate, and updatedDate variables. By altering the workspaceId, a user can reassign variables to arbitrary workspaces, which may lead to a bypass of tenant isolation in multi-workspace environments.

Recommendations Update to version 3.1.2.

Exploit

Fix

Improper Access Control

IDOR

Weakness Enumeration

CWE-284

CWE-639

CWE-915

Related Identifiers

CVE-2026-42861

GHSA-6FW7-3Q8R-M5VJ

Affected Products

Flowise

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42861.json · Exploit
• https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-6fw7-3q8r-m5vj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42861 · Security Note
• https://osv.dev/vulnerability/CVE-2026-42861 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6fw7-3q8r-m5vj · Vendor Advisory
• https://github.com/FlowiseAI/Flowise/releases/tag/flowise%403.1.2 · Note
• https://github.com/FlowiseAI/Flowise · Note
• https://t.me/cveNotify/167004 · Telegram Post
• https://t.me/cveNotify/166613 · Telegram Post